Boston Scientific: Form 8-K Item 1.05 cybersecurity incident

1. Incident summary

The issuer disclosed a cybersecurity incident under Item 1.05 of Form 8-K [8-K 0000885725-26-000059 Item 1.05]. The fields below are derived from the filing by the engine and are labeled "derived" in the inputs.

• Incident type: unknown (derived) [8-K 0000885725-26-000059 Item 1.05].
• Systems affected (derived): certain information technology systems; certain operating systems and business applications; network; distribution network; manufacturing; order processing and shipping [8-K 0000885725-26-000059 Item 1.05].
• Containment status: ongoing (derived) [8-K 0000885725-26-000059 Item 1.05].
• Operational status: partial_disruption (derived) [8-K 0000885725-26-000059 Item 1.05].
• Data types compromised: unknown (derived) [8-K 0000885725-26-000059 Item 1.05].
• Affected unit share: 1.0 (derived). This is an upper bound because the filing does not identify the affected segment, and the issuer has 2 reportable segments [8-K 0000885725-26-000059 Item 1.05].
• Sector mapping: pharma_devices. This is an internal calibration from the SIC map [scoring.yaml cyber.sector_map].

The tiers in this memo (low, moderate, elevated, high) are the engine's materiality tiers under internal calibration. They are not ratings and should not be read as such [scoring.yaml combination].

2. Business Risk

• The disclosed disruption reaches manufacturing, the distribution network, and order processing and shipping [8-K 0000885725-26-000059 Item 1.05]. For a device manufacturer, these functions sit on the revenue path. The engine therefore treats the event as an operational disruption shock rather than a data-only event [scoring.yaml cyber].
• Low scenario (7 outage days): the Business Risk tier is moderate. The engine's stated reasons are "partial disruption" and "rule for moderate met" [scoring.yaml business_tier_rule_cyber].
• Base scenario (21 outage days): the Business Risk tier is elevated. The engine's stated reasons are "outage 21 >= 14 days" and "rule for elevated met" [scoring.yaml business_tier_rule_cyber].
• High scenario (42 outage days): the Business Risk tier is elevated. The engine's stated reasons are "outage 42 >= 14 days" and "rule for elevated met" [scoring.yaml business_tier_rule_cyber].
• The outage-day values are scenario assumptions under internal calibration. They are not facts from the filing [scoring.yaml cyber].
• The affected unit share of 1.0 is an upper bound because the affected segment is not identified. The scenario results may therefore overstate the disruption if only one of the 2 reportable segments is affected [scoring.yaml cyber].
• Because the data types compromised are unknown, the engine cannot assess data-related exposure through its data-type calibration [scoring.yaml cyber].

3. Financial Risk

Inputs

• The metrics are drawn from SEC XBRL companyfacts (as-reported, USD).
  • Verified figures: CFO of $4,534M, cash interest of $319M, and operating lease liabilities of $536M.
  • Derived figures: FFO of $4,101M, debt of $11,436M, EBITDA of $4,981M, and FOCF of $3,658M.
• EBITDA, FFO and FOCF are non-GAAP style measures. They are treated as unverified.
• DCF is null because dividends paid and share repurchases are missing.
• The ratios are as-reported proxies. S&P adjustments are not applied [corporate_methodology p.33].

Table selection

• The engine applies the standard table (Corporate Methodology Table 17) by default [corporate_methodology p.33].
• Under the criteria, the table is selected from industry and country risk, which the engine does not compute. The table choice is therefore an internal calibration default, not a criteria determination [corporate_methodology p.33].
• The criteria use five-year time-weighted ratios [corporate_methodology p.32]. The inputs here reflect fiscal year 2025 only.

Pre-event ratios

• FFO/debt: 35.86%, band index 2 (30% to 45%). The relative distance to the 30% boundary is 0.1953, so the ratio is not within 10% of the boundary [corporate_methodology p.33].
• Debt/EBITDA: 2.30x, band index 2 (2x to 3x). The relative distance to the 3x boundary is 0.2347, so the ratio is not within 10% of the boundary [corporate_methodology p.33].
• Neither ratio is borderline under the 10% relative-distance test [corporate_methodology p.32].

Post-event scenarios

Sources for the table: [corporate_methodology p.33] [scoring.yaml cyber].

• In all three scenarios, both ratios stay in band index 2, which is 0 bands from the pre-event position. Each relative distance remains at or above 0.1 [corporate_methodology p.32].
• The Financial Risk tier is low in the low, base and high scenarios. The engine reports "rule for low met" in each case [scoring.yaml financial_tier_rule].
• In the high scenario, the FFO/debt distance of 0.1118 is the closest any ratio comes to the 10% borderline threshold [corporate_methodology p.32].

4. Liquidity

• The Liquidity dimension is not scored. Its state is insufficient_data in every scenario. The engine's stated reason is "required source or use missing; never treated as pass" [scoring.yaml liquidity.gate_rule].
• A null Liquidity tier does not mean low [scoring.yaml liquidity.gate_rule].
• Missing inputs: contracted_asset_sales, working_capital_change_12m and expected_shareholder_distributions.
  • Contracted asset sales feed the sources of liquidity [liquidity_descriptors p.8].
  • Working capital change and shareholder distributions feed the uses of liquidity [liquidity_descriptors p.9].
• Reference levels that cannot be tested:
  • Sources over uses of at least 1.2x, with sources minus uses staying positive after a 15% EBITDA decline [liquidity_descriptors p.13].
  • Sources over uses below 1.2x [liquidity_descriptors p.16].
• XBRL proxies are available for some inputs, such as prior-year capex and 12-month maturities. They do not cover the missing items listed above [scoring.yaml liquidity.xbrl_proxies].
• An incident that disrupts order processing and shipping can affect working capital. That input is among those missing [liquidity_descriptors p.9].

5. Governance

• No governance flags were raised in the inputs [scoring.yaml overlay_rule].
• The governance overlay is downside only. It never lowers a tier and moves a tier by one step at most [scoring.yaml overlay_rule].
• With no flags, the overlay did not change the scenario results [scoring.yaml overlay_rule].
• Overall tier: the overall tier is the worst of Financial, Business and Liquidity, with no weighted average. Dimensions without a tier are skipped rather than treated as low [scoring.yaml combination].
  • The resulting overall tier is moderate in the low scenario and elevated in the base and high scenarios.
  • The overall range is moderate to elevated, with 0 unscored cases [scoring.yaml combination].
• Because Liquidity is skipped, the overall tier does not reflect any liquidity effect [scoring.yaml combination].

6. Key watch factors

• Containment and outage duration. Containment is ongoing. The Business Risk tier moves from moderate to elevated once the outage reaches 14 days or more [scoring.yaml business_tier_rule_cyber].
• Segment identification. Disclosure of the affected segment would replace the 1.0 upper-bound affected unit share and could narrow the scenario results [scoring.yaml cyber].
• Data types. Disclosure of compromised data types would allow the engine's data-type calibration to be applied [scoring.yaml cyber].
• FFO/debt distance to the 30% boundary. In the high scenario this distance is 0.1118, close to the 10% borderline threshold. A longer outage than the high scenario would warrant reassessment [corporate_methodology p.32].
• Liquidity inputs. Information on contracted asset sales, the 12-month working capital change and expected shareholder distributions would allow the liquidity reference levels to be tested [liquidity_descriptors p.13] [liquidity_descriptors p.8] [liquidity_descriptors p.9].
• Table selection. An industry and country risk assessment could point to a table other than the standard default [corporate_methodology p.33].
• Recovery measures. Further disclosures about system restoration, patch or update activity, and any governance findings could trigger the downside-only overlay [scoring.yaml overlay_rule].

7. Sources

Filing

• [8-K 0000885725-26-000059 Item 1.05]: Boston Scientific Corporation Form 8-K, Item 1.05, https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm

Criteria excerpts

• [corporate_methodology p.33]: Corporate Methodology, Table 17 (standard table ratio ranges) and para 123 (table selection from industry and country risk).
• [corporate_methodology p.32]: Corporate Methodology, para 116 (five-year time weights) and para 118 (10% relative-distance borderline).
• [liquidity_descriptors p.8]: Liquidity Descriptors For Global Corporate Issuers, para 23 (sources of liquidity).
• [liquidity_descriptors p.9]: Liquidity Descriptors For Global Corporate Issuers, para 30 (uses of liquidity).
• [liquidity_descriptors p.13]: Liquidity Descriptors For Global Corporate Issuers, para 37 (reference levels: 1.2x and 15% EBITDA decline).
• [liquidity_descriptors p.16]: Liquidity Descriptors For Global Corporate Issuers, para 40 (reference level below 1.2x).

Internal calibration (docs/scoring/scoring.yaml)

• [scoring.yaml financial_tier_rule]
• [scoring.yaml business_tier_rule_cyber]
• [scoring.yaml cyber]
• [scoring.yaml cyber.sector_map]
• [scoring.yaml liquidity.gate_rule]
• [scoring.yaml liquidity.xbrl_proxies]
• [scoring.yaml overlay_rule]
• [scoring.yaml combination]

Financial data: SEC XBRL companyfacts (as-reported, USD).

8. Disclaimers

• This memo is an analytical aid. It is not a credit rating or a rating recommendation and does not represent the view of any rating committee.
• Based only on public information. Figures are as-reported in SEC filings unless labeled derived or estimate.
• Non-GAAP figures (including EBITDA, FFO and FOCF) are treated as unverified. Ratios are as-reported proxies without S&P adjustments.
• Materiality tiers, outage-day scenarios, sector mapping and table selection are internal calibration. They are not criteria determinations.